Hi, I'm a newcomer to ELK. Trying to get a few concepts wrapped in my head.
I've got several different devices (cisco, juniper, ubiquiti) pushing syslogs to our logstash.
I'm trying to figure out how to parse them based on format of of the message string.
Does grok pattern match the line and if it doesn't exactly match it tries the next match in sequence?
Also is there away to have the hosts or hosts.raw contain the fqdn via a inaddr dns lookup ?